SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

Download | Alert*

CVE

CVE-2011-5259

SQL injection vulnerability in lib/controllers/CentralController.php in OrangeHRM before 2.6.11.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 6.8
Exploit Score: 8.6
Impact Score: 6.4

CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL

Reference:

http://www.securityfocus.com/archive/1/520684/100/0/threaded

SECUNIA-47014

BID-50857

OSVDB-77418

http://blog.orangehrm.com/2011/12/09/security-vulnerabilities-fixed-with-orangehrm-26112/

https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_orangehrm.html

orangehrm-id-sql-injection(71569)


30479



423868



249622



909



195549



282